Information Disclosure

datasette-graphql is vulnerable to information disclosure. The vulnerability exists as it does not perform permission checks, allowing private database schema to be revealed...

GHSA-74HV-QJJQ-H7G5 datasette-graphql leaks details of the schema of private database files

Impact When running against a Datasette instance with private databases, datasette-graphql would expose the schema of those database tables - but not the table contents. Patches Patched in version 1.2. Workarounds This issue is only present if a Datasette instance that includes private databases...

PT-2020-21113

Name of the Vulnerable Software and Affected Versions datasette-graphql versions prior to 1.2 Description The issue exposes the schema of private database tables in a Datasette instance when the datasette-graphql plugin is installed and the instance is available on the public internet. However, i...